MS-500 is aimed at candidates with functional experience with Microsoft 365 workloads and Microsoft Entra ID who work on security administration. This page gives you the official content areas, a practice set for each area, three worked questions with explanations, a study plan, and answers to common questions. Microsoft is the official source for exam details, so check its pages before you book.
According to Microsoft, “A score of 700 or greater is required to pass.”[1]
MS-500 is the Microsoft 365 Security Administration exam. Microsoft describes its candidates as people with functional experience with Microsoft 365 workloads and with Microsoft Entra ID. The questions therefore assume you have worked with identity, protection and compliance settings in a tenant, not only read about them. The official outline covers identity and access, information protection, threat protection, and compliance in Microsoft 365.
Delivery is through Pearson VUE. Microsoft states that candidates can usually choose between a local test center and an online proctored exam, depending on availability for that exam and provider. Availability can differ, so check the Pearson VUE page for Microsoft when you schedule.
Scoring: a score of 700 or greater is required to pass. Microsoft reports results on its own scale, so do not try to convert 700 into a share of questions answered correctly.
Status: Microsoft says the certification and its renewal assessment are retired, and the renewal assessment is no longer offered. Before you plan around this exam, read the certification page and the exam page on Microsoft Learn to see what is currently available. Retake rules and fees are not listed here. Microsoft sets them and can change them, so use the official source. The practice sets below are still useful for reviewing the underlying Microsoft 365 security skills.
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Passing score | 700 or greater[1] | Microsoft · Nov 8, 2026 |
| Renewal | Retired (renewal assessment no longer offered)[2] | Microsoft · Nov 7, 2026 |
| Delivery | Pearson VUE test center or online proctored[3] | home.pearsonvue.com · Nov 6, 2026 |
| Eligibility | Functional experience with Microsoft 365 workloads and Microsoft Entra ID[4] | Microsoft · Nov 8, 2026 |
The content areas below are copied from the official MS-500 content outline published by Microsoft. The right-hand column shows which of our practice sets covers it.
| Official content area | Practice on this site |
|---|---|
| Implement and manage identity and access[4] | MS-500 Identity & Access Management Practise how identities are synchronized, protected and controlled, including Conditional Access and sign-in risk decisions. |
| Implement and manage information protection[4] | MS-500 Information Protection & Governance Practise choosing between sensitivity labels, data loss prevention and retention, and knowing which one stops sharing and which one keeps records. |
| Implement and manage threat protection[4] | MS-500 Threat Protection & Security Operat... Practise matching each Defender product to the workload it protects: email, endpoints, identities or cloud apps. |
| Manage compliance in Microsoft 365[4] | MS-500 Regulatory Frameworks & Compliance Practise telling apart audit, eDiscovery, insider risk and compliance reporting tools, and when each one applies. |
Prepare for the MS-500 - Microsoft 365 Security Administration exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Which Microsoft 365 Defender service protects against malicious links and attachments in email?
Answer: B. Microsoft Defender for Office 365
Explanation:
Microsoft Defender for Office 365 is correct because it provides Safe Links and Safe Attachments, which check URLs and attachments in email and collaboration tools. Defender for Identity is wrong because it watches signals from on-premises directory servers to detect identity attacks, not mail content. Defender for Endpoint is wrong because it protects devices, covering malware, vulnerabilities and device response. Defender for Cloud Apps is wrong because it is a cloud access security broker focused on how cloud apps are used and what data goes into them. The rule to remember: name the workload being attacked first (mail, identity, device or cloud app), then pick the Defender product built for that workload.
Question: Which Azure AD feature synchronizes on-premises Active Directory identities to Azure AD?
Answer: A. Azure AD Connect
Explanation:
Azure AD Connect is correct because it synchronizes on-premises Active Directory users, groups and attributes to the cloud directory. Azure AD B2B is wrong because it handles collaboration with external guest users and does not copy your own directory. Azure AD Domain Services is wrong because it provides managed domain features such as domain join and legacy authentication in Azure, not synchronization of your existing identities. Azure AD Proxy is wrong because it publishes internal web applications for remote access. Note that Microsoft now uses the name Microsoft Entra ID for Azure AD, so expect both names in study material. The rule: synchronization is a directory-sync job, while B2B, Domain Services and Proxy each solve a different access problem.
Question: Which Microsoft Defender for Cloud Apps feature discovers unsanctioned cloud applications used by employees?
Answer: B. Cloud Discovery
Explanation:
Cloud Discovery is correct because it analyzes network traffic logs to show which cloud apps employees are using, including apps nobody approved. App governance is wrong because it monitors permissions and behavior of apps that are already connected to your Microsoft 365 tenant. Conditional Access App Control is wrong because it applies real-time session controls to apps you have already chosen to route through it, so it cannot find unknown ones. Activity policies are wrong because they alert on or act on user activity inside connected apps. The rule: discovery of unknown apps comes from traffic logs, while the other features control apps you already know about.
Start with the official skills outline from Microsoft Learn and read the four content areas as a checklist. Mark each area as strong, shaky or untouched, based on your actual tenant experience rather than on how familiar the names feel.
Next, take the practice set for your weakest area under no time pressure. For every wrong answer, write down why the correct option fits and why your choice did not. The worked questions above show the pattern: name the workload or goal, then match the feature built for it. Then open the matching Microsoft Learn module or admin documentation and read the section that explains the feature you confused.
Before test day, confirm how Microsoft currently lists the exam and the delivery options on the official pages, and have your ID and testing setup sorted out in advance. Our questions are written by us with AI tools and are not real exam questions, so treat them as practice for the skills, not a preview of the paper.
Microsoft states that the Microsoft 365 Security Administrator certification and its renewal assessment are retired. Because exam availability is controlled by Microsoft, check the exam page and certification page on Microsoft Learn and the Pearson VUE Microsoft page for the current status before you plan or pay for anything. The practice sets here remain useful for reviewing the skills.
Microsoft's study guide says a score of 700 or greater is required to pass. The score is on Microsoft's own reporting scale, so it does not translate directly into a share of questions answered correctly. Use our practice sets to find weak areas rather than to predict a score.
Through Pearson VUE. Microsoft states that candidates can usually choose between a local test center and an online proctored exam, depending on availability for that exam and provider. Options can differ, so check the Pearson VUE Microsoft page when you schedule and read the online exam rules before choosing remote delivery.
Microsoft says candidates for this exam have functional experience with Microsoft 365 workloads and with Microsoft Entra ID. There is no prerequisite listed in our facts beyond that description, so confirm any current requirements on the official exam page. Hands-on work with tenant security settings helps more than reading alone.
Microsoft states that the certification and the renewal assessment are retired, and the renewal assessment is no longer offered. If you hold the credential, check your Microsoft Learn profile and the certification page for how Microsoft currently treats it, since official records are the only reliable source on this.
No. The questions on this site are written by us with AI tools to practise the skills in the official content areas. They are not copied from the real exam and do not reveal what Microsoft will ask. Use them to find gaps, then study the official Microsoft Learn material for those topics.
How we verify: editorial & fact-checking policy. Report an error: contact us.